Well it happened a while back, remember? The French researcher Guillaume Tena who got in trouble for breaching French copywrite laws by decompiling some software.
Now people are generally starting to worry about disclosing vulnerabilities through any channels, does there need to be some kind of anonymous PGP key based system for vulnerability disclosure? So people can do it without fear of getting sued?
The CERIAS weblog examines the risks associated with reporting vulnerabilities. In the end, he advises that the risks (in one situation, at least) were almost not worth the trouble, and gives advice on how to stay out of trouble. Is it worth it to report vulnerabilities despite the risks, or is the chilling effect demonstrated here too much?
A typical difficulty encountered by vulnerability researchers is that administrators or programmers often deny that a problem is exploitable or is of any consequence, and request a proof. This got Eric McCarty in trouble & the proof is automatically a proof that you breached the law, and can be used to prosecute you!
It’s an interesting point when it comes to public disclosure, unless you have permission, how do you prove you’ve found a vulnerability without getting in trouble?
HD Moore also discussed this recently with:
- Microsoft Schannel Vulnerabilty – Patch It NOW
- Serious Linux/UNIX FTP Flaw Allows Command Execution
- Microsoft Zero Day OLE Vuln Being Exploited In Powerpoint
- 3Com’s TippingPoint Finds New IE Vulnerabilities
- What Responsibility do Anti-Spyware Researchers Have?
- Sandcat by Syhunt – Web Server & Application Vulnerability Scanner
Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 228,151 views
- AJAX: Is your application secure enough? - 119,184 views
- eEye Launches 0-Day Exploit Tracker - 85,082 views